Deterministic Secure Direct Communication Using Entanglement 
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A novel secure communication protocol is presented, based on an entangled pair of qubits and 
allowing asymptotically secure key distribution and quasi-secure direct communication. Since the 
information is transferred in a deterministic manner, no qubits have to be discarded. The transmis- 
sion of information is instantaneous, i.e. the information can be decoded during the transmission. 
The security against arbitrary eavesdropping attacks is provided. In case of eavesdropping attacks 
with full information gain, the detection rate is 50% per control transmission. The experimen- 
tal realization of the protocol is feasible with relatively small effort, which also makes commercial 
applications conceivable. 



Introduction. — Cryptographic schemes based on quan- 
tum mechanics are usually non-deterministic H, ^. 
Alice, the sender, can encode a classical bit into a quan- 
tum state, which is then sent to Bob, but she cannot 
determine the bit value that Bob will finally decode. In- 
spite of that, such non-dctcrministic communication can 
be used to establish a shared secret key between Alice 
and Bob, consisting of a sequence of random bits. This 
secret key can then be used to encrypt a message which is 
sent through a classical public channel. Recently, a novel 
quantum communication protocol has been presented Q 
that allows secure direct communication, where the mes- 
sage is deterministically send through the quantum chan- 
nel, but can only be decoded after a final transmission 
of classical information. We present a communication 
scheme, the "ping-pong protocol" , that also allows for 
deterministic communication. This protocol can be used 
for the transmission of either a secret key or a plaintext 
message. In the latter case, the protocol is quasi-secure, 
i.e. an eavesdropper is able to gain a small amount of 
message information before being detected. In case of 
a key transmission the protocol is asymptotically secure. 
In contrast to other quantum cryptographic schemes, the 
presented scheme is instantaneous, i.e. the information 
can be decoded during the transmission and no final 
transmission of additional information is needed. The 
basic idea of the protocol, encoding information by local 
operations on an EPR pair, has already been raised by 
Bennett and Wiesner In our protocol, we follow this 
idea, but abandon the dense coding feature in favour of 
a secure transmission. 

The ping-pong protocol. — When two photons are max- 
imally entangled in their polarization degree of freedom, 
then each single photon is not polarized at all. De- 
note the horizontal and vertical polarization state by 
|0) and |1), respectively, then the Bell states li^"^) = 
^(|01) ± |10)) are maximally entangled states in the 
two-particle Hilbert space H = Ha ® W_b. A measure- 
ment of the polarization of one photon, say A, leads 
to a completely random result. This is reflected by 
the fact that the corresponding reduced density matrices, 
p\ := Ttb{\iJ-'^){iP^\} are both equal to the complete 



mixture, = ^1a- Hence, no experiment performed on 
only one photon can distinguish these states from each 
other. However, since the states |?/'^} are mutually or- 
thogonal, a measurement on both photons can perfectly 
distinguish the states from each other. In other words: 
One bit of information can be encoded in the states \ip^), 
which is completely unavailable to anyone who has only 
access to one of the photons. As one can easily verify, 
the unitary operator = ((T^01) = (|0)(0| ~ |l)(l|)(g) 1 
flips between the two states 



|^±} = I^T). 



(1) 



Altough (7^ acts locally, i.e. on one photon only, it has 
a non-local effect. Someone who has access to one sin- 
gle photon only, can encode one bit of information, but 
he cannot decode it, since he has no access to the other 
photon. This is a situation perfectly suited for a crypto- 
graphic scenario. Bob prepares two photons in the state 
t/'^)- He keeps one photon, the "/lOJTie qubif\ and sends 
the other one, the "travel qubit" , to Alice ("ping!"). Alice 
decides either to perform the operation on the travel 
qubit or to do nothing, i.e. to perform the operation 1. 
Then she sends the travel qubit back to Bob ("pong!"). 
Bob, who has now both qubits again, performs a Bell 
measurement resulting in either lip'^) or \'ip~), depending 
on what Alice did. Thus, he has received one bit of in- 
formation from Alice. One qubit travels forth and back 
("ping-pong!") and one bit of information flows from Al- 
ice to Bob. Let us introduce two communication modes, 
"message mode" and "control mode" (see Figs. 0,^. By 
default, Alice and Bob are in message mode and com- 
municate the way described above. With probability c, 
Alice switches to control mode and instead of perform- 
ing her operation on the travel qubit, she performs a 
measurement in the basis Bz = {|0), |1)}. Using the pub- 
lic channel, she sends the result to Bob, who then also 
switches to control mode and performs a measurement 
in the same basis Bz- Bob compares his own result with 
Alice's result. If both results coincide. Bob knows that 
Eve is in the line and stops the communication, [t] Let 
us give an explicit algorithm for the protocol. 



p.O) Protocol is initialized. 
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FIG. 1: Message mode. Dashed lines are qubit transfers. 



transmitted is a sequence 
xn e {0,1}. 



(xi, . . . , xjv), where 



p.l) n — n + 1. Alice and Bob are set to message mode. 
Bob prepares two qubits in the Bell state j?/;^} — 

7l(|Ol) + |lO)). 

p. 2) He stores one qubit, the home qubit, and sends the 
other one, the travel qubit, to Alice through the 
quantum channel. 

p. 3) Alice receives the travel qubit. With probability c 
she switches to control mode and proceeds with c.l, 
else she proceeds with m.l. 

c.l) Alice measures the travel qubit in the basis Bz 
and obtains the result i £ {0,1} with equal 
probability. 

C.2) She sends i through the public channel to Bob. 

C.3) Bob receives i from the public channel, 
switches to control mode and measures the 
home qubit in the basis resulting in the 
value j. 

C.4) {i = j): Eve is detected. Abort transmission, 
(i 7^ j): Set n — n ~ 1 and Goto p.|l]. 

m.l) Define Co :— 1 and Ci :— a^- For a;„ G {0, 1}, 
Alice performs the coding operation C^^ on 
the travel qubit and sends it back to Bob. 

m.2) Bob receives the travel qubit and performs a 
Bell measurement on both qubits resulting in 
the final state S {|V'^)i IV'~)}- He decodes 
the message as 




(2) 
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FIG. 2: Control mode. Solid lines are classical transfers. 



m.3) (n<N): Goto pj|. (n = TV): Goto p.|. 

p. 4) Message is transmitted from Alice to Bob. 
Communication successfully terminated. 

Security proof. — Eve is an evil quantum physicist able 
to build all devices that are allowed by the laws of quan- 
tum mechanics. Her aim is to find out which operation 
Alice performs. Eve has no access to Bob's home qubit, 
so all her operations are restricted to the travel qubit, 
whose state is (to Eve) indistinguishable from the com- 
plete mixture pA = TTB{\tp~^){ip^\} = ^^A- The most 
general quantum operation is a completely positive map 
£ : S{TLa) S{TLa) on the state space S{1-La)- Due 
to the Stinespring dilation theorem Q, any completely 
positive map can be realized by a unitary operation on 
a larger Hilbert space. For TLa and £ given, there is an 
ancilla space Ti.E of dimension dimT-^g < (dimTi^)^, an 
ancilla state |x) G He, and a unitary operation E on 
Ha ® He, such that for all states pA & S{Ha), we have 



£{pA)^TrE{E{pA(E>\x){x\)E^. 



(3) 



In order to gain information about Alice's operation. Eve 
should first perform the unitary attack operation E on 
the composed system, then let Alice perform her coding 
operation C on the travel qubit, and finally perform a 
measurement on the composed system (see Fig. ||). Since 
a probable control measurement by Alice takes place be- 
fore Eve's final measurement, the latter has no infiuence 
on the detection probability for Eve's attack. All that 
can be detected is the attack operation E. Let us an- 
alyze the detection probability d, given an attack oper- 
ation E. Since for Eve the state of the travel qubit is 
indistinguishable from the complete mixture, we can re- 
place the state of the travel qubit by the a priori mixture 
PA — 5|0)(0|-|-^|1)(1|, which corresponds to the situation 
where Bob sends the travel qubit in either of the states 
|0) or |1), with equal probability p = 1/2. Let us at first 
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consider the case where Bob sends |0). Ahce adds an an- 
cilla in the state \x) and performs the unitary operation 
E on both systems, resulting in 

IV') = ^|0,x) =a|0,xo)+/3|l,Xi), (4) 

where |xo)j Ixi) a.re pure anciUa states uniquely deter- 
mined by E, and |ap-|-|/3p = l. In a subsequent control 
measurement, Alice measures the travel qubit in the ba- 



sis Bz = {|0), |1)} and sends the result to Bob. Without 
Eve, the result will always read "0" , hence the detection 
probability for Eve's attack in a control run reads 

= (5) 

Now let us analize how much information Eve can max- 
imally gain when there is no control run. After Eve's 
attack operation, the state of the system reads 



p' = = |ano,xo)(0,Xo| + |/3ni,Xi)(l,Xi|+a/3*|0,xo)(l,Xi|+a*/?|l,Xi)(0,Xo| 



(6) 



which can be rewritten in the orthogonal basis 
{|0,xo), |l,Xi)} as 



a(3' 



a*f3 



(7) 



Alice encodes her bit by applying the operation Cq = 1 
or Ci = dz to the travel qubit, with probability po andpi, 
respectively. The state of the travel qubit after Eve's at- 
tack operation and after Alice's encoding operation reads 



Pi) \f3? 



Pi. 



(8) 



The maximal amount Iq of classical information that 
can be extracted from this state is given by the von- 
Neumannn entropy, Iq = S{p") = — Trjp" logj p"}. In 
order to calculate the von-Neumann entropy we need the 
eigenvalues A of p", which are the roots of the characteris- 
tic polynomial det(p" — Al), yielding the two eigenvalues 
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FIG. 3: A general eavesdropping attack. 



Ai,2 - ^ (l ± Vl-4|«/3P[l-(po-Pi)2]) , (9) 



so we have 



-Ailog2 Al - A2 log2 A2. 



(10) 



The maximal information gain /q can be expressed as a 
function of the detection probability d. Using (|^), we 
have \a(3\^ = (1 - = {d- <P). and therefore 



1 , 1 



Ai,2 - § ± -v/l-(4rf-4rf2)[i_(po_pi)2] 



(11) 



Now assume that Bob sends |1) rather than |0). The 
above calculations can be done in full analogy, result- 
ing in the same crucial relations ( ]To| , pl] ). Eve's task 
is, of course, to minimize d. Though if she chooses 
an eavesdropping action E that provides c? = 0, then 
Al = 1, A2 = 0, which implies Iq — Q, therefore Eve can 
gain no information at all. Thus we have shown: 

Any effective eavesdropping attack can he detected. — 
In the case po = pi = 1/2, where Alice encodes exactly 1 
bit, expression (|ll| ) simplifies to Ai^2 — ^±|^— d], or Ai — 
d, X2 = 1 — d. Interestingly, the maximal information 
gain is equal to the Shannon entropy of a binary channel. 



loid) = -dl0g2 d - (1 - d) l0g2(l - d). 



(12) 



The function /o('^) has a maximum at d = 1/2, and can 
be inversed on the interval [0, 1/2], giving a monotonous 
function < d(/o) < 1/2, Iq £ [0, 1]. By choosing a de- 
sired information gain /q > per attack. Eve has to face 
a detection probability d{Io) > 0. If she wants to gain 
the full information {Iq = 1), the detection probability 
is d{Io = 1) = 1/2. 

Direct communication versus key distribution. — In 
contrast to quantum key distribution protocols like BB84 
Q, the ping-pong protocol provides a deterministic 
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transmission of bits, hence it is possible to communi- 
cate the message directly from Alice to Bob. Assuming 
that Eve wants to gain full information in each attack, 
the ping-pong protocol provides a detection probability 
oi d = 1/2, which is significantly higher than the de- 
tection probability of the BB84 protocol, where we have 
(i = i X i = I; for the same situation. Furthermore, the 
BB84 protocol has a probability of 1/2 that a transmit- 
ted bit has to be discarded due to the wrong choice of 
basis on both sides. 

Taking into account the probability c of a control run, 
the effective transmission rate, i.e. the number of mes- 
sage bits per protocol run, reads r — 1 — c, which is 
equal to the probability for a message transfer. Say, Eve 
wants to eavesdrop one message transfer without being 
detected. The probability for this event reads 



s{c,d) = (l-c) + c(l-d)(l-c) + 
c2(l-d)2(l_c) + ... 

1 -c 
l-c(l-d)' 



(13) 
(14) 



where the terms in the (geometric) series correspond to 
Eve having to survive 0, 1, 2, . . . control runs before she 
gets to eavesdrop on a message run, finally yielding the 
desired information of Io{d) bits. After n successful at- 
tacks Eve gains nioid) bits of information and survives 
with probability s", thus the probability to successfully 
eavesdrop / = nIo{d) bits reads s{I, c, d) — s(c, dy/^°^'^\ 
so 



s{I,c,d) = 



1 -c 



1 - c(l - d) 



I/Io(d) 



(15) 



where Io{d) is given by (|l|). For c > 0, d > 0, this 
value decreases exponentially but is nonzero. In the limit 
/ — > oo (a message or key of infinite length) we have 
s — !■ 0, so the protocol is asymptotically secure, just like 
the BB84 protocol. Let us give an example. A conve- 
nient choice of the control parameter is c — 0.5, where 
on the average every second bit is a control bit. Say, 
Eve wants to gain full information in each attack, thus 
/q = 1 and d — 1/2. The probability that Eve success- 
fully eavesdrops 1 character (8 bits) is already as low as 
s ~ 0.039. In Fig. ^ we have plotted the eavesdropping 
success probability as a function of the information gain 
J, for c = 0.5 and for different detection probabilities d 
that Eve can choose. (Note that for d < 1/2 Eve only 
gets part of the message right and does not even know 
which part.) If desired, the security can arbitrarily be 
improved by increasing the control parameter c at the 
cost of decreasing the transmission rate. Let us call such 
communication quasi- secure^\ If we want a perfectly 
secure communication (which is, strictly speaking, also 
not really perfect), we must abandon the direct transfer 
in favour of a key transfer. In this case, Alice does not 
transmit the message directly to Bob but rather takes a 
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FIG. 4: Eavesdropping success probability as a function of 
the maximal eavesdropped information, plotted for different 
detection probabilities d. 



random sequence of N bits from a secret random number 
generator. After a succesful transmission, the random se- 
quence is used as a shared secret key between Alice and 
Bob. Eve has virtually no advantage in eavesdropping 
only a few bits, because one can choose classical privacy 
amplification protocols that make it very hard to decode 
parts of the message with only some of the key bits given. 
The one-time-pad scheme, by the way, is not quite a good 
choice, because here each eavesdropped key bit directly 
yields one decoded message bit. Anyway, as soon as Eve 
is detected, the transfer stops and she has learned noth- 
ing but a sequence of nonsense random bits. 

Experimental feasibility. — The Bell state can be 
created by parametric down- conversion. Bob's Bell mea- 
surement must only distinguish between the states IV"^), 
which can be accomplished, too. The storage of one 
photon is necessary only for a duration corresponding to 
twice the distance between Alice and Bob. The encod- 
ing procedure corresponds to a controlled (T^-operation, 
which can be realized by triggered optical elements. The 
correlation test involves a simple measurement of the lin- 
ear polarization in a fixed basis. Altogether, the exper- 
imental realization of the ping-pong protocol should be 
feasible using nowaday's technology. Even a commercial 
application could be envisaged. 
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